+ All Categories
Home > Documents > Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains...

Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains...

Date post: 03-Apr-2018
Category:
Upload: vuongdien
View: 214 times
Download: 2 times
Share this document with a friend
15
Privacy Impact Assessment Name of Project: NPRC Registry Files Project's Unique ID: AAC Legal Authority(ies): 44 U.S.C. 2108,2110, and 2907 Purpose of this System/Application: The National Personnel Records Center (NPRC) Registry Files is one of several National Archives and Records Administration (NARA) applications housed at the Department of Veteran's Affairs (VA) Austin Automation Center (AAC) located in Austin, TX. NPRC Registry Files contains various segments. Those segments are outlined below. Military Personnel Records (MPR) System The MPR system is a large index to Official Military Personnel Files (OMPF) and related documents for individuals that have served in one of the five branches of the United States military. Overall, the system functionality is relatively simple in its structure and process. Its primary purpose is to produce query results based on the input of a veteran's name and social security number (SSN) or service number. The query results are then presented as a finding aid - either on a screen or in printed form. This query results identifies the location of the veteran's records within the facility. The veteran's record is retrieved manually from the location identified by a NARA staff member. Information in the MPR system is externally accessible to the Department of Defense (DOD), Veterans Administration (VA) and other authorized Federal agencies via a secure web connection. Civilian Personnel Records (CPR) System The CPR system is a large index to Official Personnel Files (OPF) for individuals that have served in the civil service of the Federal govemment. The system also contains information on certain govemment VIPs such as first ladies and cabinet members and has information about current federal and postal employees. Like the MPR system, the CPR system facilitates research services by providing information conceming the location of OPF's identified by social security numbers. Index information in the CPR system is externally accessible to OPM via a secure web connection. Medical Registry System (MRS) MRS was developed to automate the accessing and retrieval of inpatient and outpatient records retired to the National Personnel Records Center (NPRC) by military medical treatment facilities worldwide. Facilities send electronic index files (listing retirement eligible records) to NPRC as advance notices of the pending shipments. Upon approval of the advance notice files, the facilities are notified to ship the records. The system provides the capability for automated assignment of transfer numbers, shelf locations, and registry numbers. Users at the medical facilities and at NPRC have
Transcript
Page 1: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

Privacy Impact Assessment

Name of Project: NPRC Registry Files Project's Unique ID: AAC

Legal Authority(ies): 44 U.S.C. 2108,2110, and 2907

Purpose of this System/Application: The National Personnel Records Center (NPRC) Registry Files is one of several National Archives and Records Administration (NARA) applications housed at the Department of Veteran's Affairs (VA) Austin Automation Center (AAC) located in Austin, TX. NPRC Registry Files contains various segments. Those segments are outlined below.

Military Personnel Records (MPR) System The MPR system is a large index to Official Military Personnel Files (OMPF) and related documents for individuals that have served in one of the five branches of the United States military. Overall, the system functionality is relatively simple in its structure and process. Its primary purpose is to produce query results based on the input of a veteran's name and social security number (SSN) or service number. The query results are then presented as a finding aid - either on a screen or in printed form. This query results identifies the location of the veteran's records within the facility. The veteran's record is retrieved manually from the location identified by a NARA staff member. Information in the MPR system is externally accessible to the Department of Defense (DOD), Veterans Administration (VA) and other authorized Federal agencies via a secure web connection.

Civilian Personnel Records (CPR) System The CPR system is a large index to Official Personnel Files (OPF) for individuals that have served in the civil service of the Federal govemment. The system also contains information on certain govemment VIPs such as first ladies and cabinet members and has information about current federal and postal employees. Like the MPR system, the CPR system facilitates research services by providing information conceming the location of OPF's identified by social security numbers. Index information in the CPR system is externally accessible to OPM via a secure web connection.

Medical Registry System (MRS) MRS was developed to automate the accessing and retrieval of inpatient and outpatient records retired to the National Personnel Records Center (NPRC) by military medical treatment facilities worldwide. Facilities send electronic index files (listing retirement eligible records) to NPRC as advance notices of the pending shipments. Upon approval of the advance notice files, the facilities are notified to ship the records. The system provides the capability for automated assignment of transfer numbers, shelf locations, and registry numbers. Users at the medical facilities and at NPRC have

Page 2: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

online access to the MRS master file through a secure web site. Authorized users may submit inquiries and order records electronically.

X-Ray Index Retrieval System (XRAY) The XRAY system is a relatively small (compared to CPR and MPR) index to x-rays for indiyiduals that have served in one of the five branches of the United States military. The index data provides location information for entrance and separation chest x-rays for former military personnel whose records are stored in the NPRC. Overall, the system functionality is relatively simple in its structure process. Its primary purpose is to produce query results based on the input of a veteran's SSN or service number. The query resuUs are then presented as a finding aid - either on a screen or in printed form. The query results identify the location of the veterans' records within the facility. The records are retrieved manually by a NARA staff member. It should be noted that no names are associated with the SSNs in this system.

Patient Index Retrieval System (PIRS) The PERS system contains infonnation about hospitalization of veterans and their dependents. This is not a NARA system; rather, NARA acquired it from the DOD and added it to the registry for ease of reference. Index information is externally accessible to selected DOD agencies via a secure web link. The information contained on the system is not actual medical data or even the location of physical records. Instead, it is identifying information about dates of hospitalization and other data relating to the hospitalization. In this sense, it is not a registry system as are CPR, MPR, XRAY and MRS, since it does not identify where the records are actually located. It should be noted that no names are associated with the SSNs in this system.

Section 1: Information to be Collected

1. Describe the information (data elements and fields) available in the system in the following categories:

This system contains three categories of information about individuals:

• Employees: Information about NARA Federal Record Center (FRC) employees who use the system to perform their jobs. The information includes login, password, name, SSN, telephone number, job title, employer, office address and systems to which access has been granted.

• External Users: Information about Federal Govemment employees (outside of NARA) who use the system to request access to Federal records stored in a NARA operated FRC. The information includes, login, password, agency name, office name and symbol, agency address, user's full name, job title, phone and fax numbers, email address, employment status (Federal employee or contractor). If a contractor, includes employer name and expiration date of contract.

Page 3: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

Public Individuals: Information about individuals who have records stored at the National Personnel Records Center including military persormel. Federal civilian personnel and medical records including X-Rays for both military and dependant military personnel. This information includes the name and/or SSN and/or service number of the subject of the record, date of birth (CPR registry), branch of service (MPR registry), agency of employment (CPR registry), hospital name and date of treatment, date of entry and discharge (X-Rays) and is accessible by SNN or name. Although the system maintains information on individuals, there is no public access to the system. Audit Trail Information (including employee log-in information): NPRC can obtain information conceming employee login to the Corporate Franchise Datacenter (CFD), formerly AAC. In addition, NPRC can obtain transactions that are uploaded by NARA.

2. Describe/identify which data elements are obtained from files, databases, individuals, or any other sources?

NARA operational records: The inquiries that NPRC receives for copies of records or record infonnation must contain certain information about the subject of the record in order for NPRC to search any of the registries. Generally, the registries serve as indices for record locations.

The MPR registry generally requires the full name of the subject of the record, their social security number (SSN) and/or military service number (SN). While the branch of service and date of birth are helpfill in making a positive identification, if the SSN or SN is unknown, NPRC staff is not required to search this registry.

The CPR registry generally requires the full name of the subject of the record, the SSN and date of birth.

The XRAY system requires the military service number or the social security number of the subject of the record in order to query the system. Again, there are no names associated with the SSNs in this system.

MRS is a registry of inpatient and outpatient medical treatment record locations. In order to locate records within the system, the SSN of the patient or sponsor is required.

The PIRS system is not an actual registry or index to record locations. It is an index of hospitalizations (not diagnoses) and dates of hospitalization for military service members and their dependents. A query of this system requires the military service member's SSN and/or [?] SN (if they had one assigned). The PIRS printout will show: (1) patient registry number for each clinical hit; (2)

Page 4: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

family member prefix (FMP); (3) date of admission/ treatment [could be shown as month/day/year, or month/year, or day/year, or Julian date]; and (4) place of treatment. A positive PIRS printout does not mean a record is actually at NPRC. A search of the Standard Forml35s and/or the stacks, based on the name of the treatment facility and dates of treatment, is still required to determine if the records have been retired to NPRC or may still be at the treatment facility (hospital) indicated. Again, no names are linked to SSNs in PIRS.

b. Public Individuals: Public individuals are not given access to any of the NPRC registries. All public individuals are required to fumish enough information in order for NARA/govemment employees to search the various registries for evidence that a record exists and that there is an NPRC stack location. For the MPR registry, the veteran's name and SSN and/or SN are needed. The branch of service is helpful, although not always required. For the CPR registry, the employee's name, SSN and date of birth are needed. The agency with which the subject of the record was employed is also helpful. For the X-ray registry the name, branch of service and SN are needed. For MRS the patient's or sponsor's SSN is needed. For PIRS the service member's SSN and SN (if assigned) are needed to query the system. This information is submitted by the public to help facilitate searches in the NPRC Registry Files. No information, protected under the Privacy Act, is released to public individuals without the written consent of the subject of the record or the legal next-of-kin.

c. Employees: Employees are required to fumish information contained on the VA Form 9957, July 1997 revision, ACRS Time Sharing Request Form. Information on this form includes, but is not limited to, the action requested, potential user's name, customer ID, SSN, telephone number and specific system applications to which they desire access.

d. Other Federal agencies: Federal agencies desiring access to any of the registry Systems must complete the VA Form 9957 (described in 2. c. above).

e. State and local agencies N/A

f Other third party source N/A

Section 2: Why the Information is Being Collected

1. Is each data element required for the business purpose of the system? Explain. Yes. NPRC needs each data element in order to provide the appropriate level of access to achieve the NPRC mission-critical tasks and performance goals which support the NARA Strategic Plan and mission.

2. Is there another source for the data? Explain how that source is or is not used? NPRC does not have another source for the data.

Page 5: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

Section 3: Intended Use of this Information

1. Will the system derive new data or create previously unavailable data about an individual through aggregation from the information collected, and how will this be maintained and filed?

No.

2. Will the new data be placed in the individual's record?

N/A

3. Can the system make determinations about employees/the public that would not be possible without the new data?

No.

4. How will the new data be verified for relevance and accuracy?

N/A

5. If the data is being consolidated, what controls are in place to protect the data from unauthorized access or use?

N/A

6. If processes are being consolidated, are the proper controls remaining in place to protect the data and prevent unauthorized access? Explain.

N/A

7. Generally, how will the data be retrieved by the user?

The user logs into the system and is validated through password control. There are limits placed on access to a particular registry file, but once access to a file is granted, the user will see all the data in that particular file. The user retrieves data through a set of predefined reports and queries that are contained within the application.

8. Is the data retrievable by a personal identifier such as a name, SSN or other unique identifier? If yes, explain and list the identifiers that will be used to retrieve information on an individual. The data can be retrieved by either name or SSN.

Page 6: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

9. What kinds of reports can be produced on individuals? What will be the use of these reports? Who will have access to them? The data is used to determine the physical location of paper records pertinent to a single individual within the NPRC facilities. The data/report (such as a Finding Aid) is used to confirm a record was sent to NPRC, to locate the record within the stacks, to identify the location from which a record was pulled and to provide infonnation conceming the office (intemal or extemal) to which the record was sent.

10. Can the use of the system allow NARA to treat the public, employees or other persons differently? If yes, explain. Yes. The requested use and the content of the records require that NARA establish different release and access procedures.

11. Will this system be used to identify, locate, and monitor individuals? If yes, describe the business purpose for the capability and the controls established explain. No. The system is used to assist NPRC staff in identifying and locating records of individuals only.

12. What kinds of information are collected as a function of the monitoring of individuals? N/A 13. What controls will be used to prevent unauthorized monitoring? The AAC has in place a set of extensive controls to prevent unauthorized monitoring. These controls are documented in the Report on Controls placed in Operation and Tests of Operating Effectiveness (SAS 70) dated September 5, 2006. This report was completed by Independent Auditor KPMG (copy available upon request).

14. If the system is web-based, does it use persistent cookies or other tracking devices to identify web visitors? No. The system is an intemal web interface, not a public interface.

Section 4: Sharing of Collected Information

1. Who will have access to the data in the system (e.g., contractors, users, managers, system administrators, developers, other)? AAC System Administrators, authorized Federal employee users, managers, on-site system administrators and developers.

2. How is access to the data by a user determined and by whom? Are criteria, procedures, controls, and responsibilities regarding access documented? If so, where are they documented (e.g., concept of operations document, etc.). AAC System Administrators have access to all data. The level of access granted to others is based upon the tasks they perform relative to the NPRC mission. VA Form

Page 7: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

9957, July 1997 revision, ACRS Time Sharing Request Form, is the central form utilized in managing user account requests and the system access they are granted. The form is completed by the user's supervisor and submitted to NARA system administrators at each respective site for review. If accepted, NARA administrators submit ACRS account requests as outlined on that specific forms.

Memorandums of Agreement have been established between NPRC and Liaison Offices and Agencies which serve as the basis for each office to access and utilize NARA computer equipment, network services and various NARA managed data systems in accordance with NARA computer use/security directives. Non-compliance with these directives or the terms identified in the Memorandum of Agreement can result in termination of Liaison Office access and removal of NARA provided hardware.

3. Will users have access to all data on the system or will the user's access be restricted? Explain. Yes. There are limits placed on user access to a particular registry file, but not to the data within the particular file once access is granted. Access permissions are controlled by the AAC System Administrator.

4. What controls are in place to prevent the misuse (e.g., unauthorized browsing) of data by those who have been granted access (please list processes and training materials)? The AAC has in place a set of extensive controls to prevent unauthorized monitoring. These controls are documented in the Report on Controls placed in Operation and Tests of Operating Effectiveness (SAS 70) dated September 5, 2006. This report was completed by Independent Auditor KPMG (copy available upon request).

The login screen for all users contains the following statement:

"This is a United States Govemment system, owned, operated, and maintained by the National archives and Records Administration (NARA). Unauthorized use of this system is strictly prohibited and may be subject to criminal prosecution. NARA may monitor any activity or communication on the system and retrieve any information stored with the system. By accessing this system you expressly consent to such monitoring and information retrieval for law enforcement and other purposes. Users should have no expectation of privacy as to any communication or information stored within this system, including information stored locally on the hard drive or other media in use with this unit. Unauthorized use of this system is a violation of Federal law 18 U.S.C. 1030 and will be prosecuted to the full extent of the law."

5. Are contractors involved with the design and development of the system and will they be involved with the maintenance of the system? If yes, were Privacy Act contract clauses inserted in their contracts and other regulatory measures addressed? The AAC has extensive contract clauses inserted in contracts to ensure proper handling of the data.

Page 8: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

6. Do other NARA systems provide, receive or share data in the system? If yes, list the system and describe which data is shared. If no, continue to question 8. Yes. The MPR registry uploads a copy daily to the Case Management and Reporting System, CMRS. (System NARA 35)

7. Have the NARA systems described in item 6 received an approved Security Certification and Privacy Impact Assessment? Yes. CMRS has received an approved Security Certification and Privacy Impact Assessment. The PIA for CMRS can be found at http://vyww.archives.gov/foia/privacy­program/privacy-impact-assessments/cmrs-pia.pdf Likewise, NARA has published a Privacy Act system of records notice for information contained in CMRS. That notice, NARA 35, can be found at http://www.archives.goy/foia/priyacy-program/nara-35.html.

8. Who will be responsible for protecting the privacy rights of the public and employees affected by the interface? The NPRC Registry Files system owner, individual users and AAC administrator and staff are responsible for managing and securing any personal data that resides in the system.

9. Will other agencies share data or have access to the data in this system (Federal, State, Local, or Other)? If so list the agency and the official responsible for proper use of the data, and explain how the data will be used. Service Level Agreements pertaining to access to the data in the NPRC registries have been established between NARA and the following agency liaisons/offices: AF National Guard, AF Reserve, AF Reserve Recmiting, Army National Guard, Army Review Board, Anny HR Command (fonnerly AR PERSCOM), USAREC, CIA, DSS, FAA, FBI, Marine Corps, Naval Personnel Command, Naval Reserve Recmiting, Navy Criminal Investigative Service, Navy Recmiting, OPM/USIS, Secret Service and the VA.

CPR Registry: United States Investigative Services (Stacey Wagster and Judy Horace)­conduct mission related investigations and NARA Human Resource Office (Jerry Pirtle)­conduct mission-related work.

MRS: Air Force, Army, Navy, Coast Guard, Department of Homeland Security, NARA, OPM, and VA.

MPR Registry: See Appendix A for listing of agencies having access to MPR Registry.

X-Ray Index Retrieval System: United States Investigative Services (Stacey Wagster and Judy Horace)-conduct mission related investigations.

Patient Index Retrieval System: Defense Security Service, Navy Personnel Command, VA Liaison Office, Naval Criminal Investigative Service, Air National Guard, Air Force Reserve Recmiting, United States Investigative Service, FBI, CIA, United States Marine Corps, Navy Recmiting, Navy Persormel Command, Army Human Resource Command,

Page 9: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

United States Air Force, Navy Medical Center (Portsmouth, VA), Army Review Board Agency, United States Air Force Liaison (St. Louis, MO).

Section 5: Opportunities for Individuals to Decline Providing Information

1. What opportunities do individuals have to decline to provide information (i.e., where providing information is voluntary) or to consent to particular uses of the information (other than required or authorized uses), and how can individuals grant consent? The information contained in the systems is not provided by the individual subject of the record. Information is obtained from the Department of Defense and from Federal personnel offices.

2. Does the system ensure "due process" by allowing affected parties to respond to any negative determination, prior to final action? N/A

Section 6: Security of Collected Information

1. How will data be verified for accuracy, timeliness, and completeness? What steps or procedures are taken to ensure the data is current? Name the document that outlines these procedures (e.g., data models, etc.). NPRC collects infonnation directly from the individual to ensure accuracy, timeliness and completeness. Each application has integrity and validity checks to ensure the integrity of the data. The last SAS 70 (Statement on Auditing Standards No. 70) was performed at the AAC September 5, 2006.

2. If the system is operated in more than one site, how will consistent use of the system and data be maintained in all sites? The system operates at the Department of Veteran's Affairs (DVA) Austin Automation Center (AAC). Users access the system from many sites, however, all data is retained at the AAC.

3. What are the retention periods of data in this system? Disposal is not authorized for the OMPFs because they are all slated to become permanent. The retention periods for the other records are described below. The data in the registries is only relevant if the records are in the custody of NARA/NPRC.

The OPFs have a retention period of 65 years after separation from Federal Service. The entrance and separation X-rays have a retention period of 65 years. Inpatient military medical records retired from teaching facilities are transferred to NPRC (5) years after the end of the calendar year of the last date of treatment. They are retained for 50 years and then destroyed after the end of the calendar year of last treatment. Inpatient medical treatment records are transferred to NPRC one (1) year after the end of the calendar year

Page 10: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

of the last date of treatment and retained until 50 years after the end of the calendar year of the last treatment. Outpatient treatment records are transferred to NPRC two (2) years after the end of the calendar year of the last date of treatment and retained for 50 years after the end of the calendar year of the last treatment.

4. What are the procedures for disposition of the data at the end of the retention period? How long will the reports produced be kept? Where are the procedures documented? Cite the disposition instructions for records that have an approved records disposition in accordance with, FILES 203. If the records are unscheduled that cannot be destroyed or purged until the schedule is approved. Disposal is not authorized for OMPFs. Because of the many freezes placed on the disposition of medical records (inpatient and outpatient), the data in the registries will not be disposed of

5. Is the system using technologies in ways that the Agency has not previously employed (e.g., monitoring software. Smart Cards, Caller-ID)? If yes, describe. No.

6. How does the use of this technology affect public/employee privacy? N/A

7. Does the system meet both NARA's IT security requirements as well as the procedures required by federal law and policy?

Yes

8. Has a risk assessment been performed for this system? If so, and risks were identified, what controls or procedures were enacted to safeguard the information?

The VA Austin Automation Center assesses the risks of NARA systems executing at their facility on an annual basis. The overall system risk was identified as Medium-Low. The versions of operating system and system specific related software are outdated and it is no longer readily possible to apply patches and updates. These risks will be addressed in conjunction with the deployment of the ARCIS application which is targeted for the 2008 - 2009 time frame. The TASK application will be replaced at that time.

9. Describe any monitoring, testing, or evaluating done on this system to ensure continued security of information.

The VA conducts monthly vulnerability scans on all hardware supporting NARA applications, as well as their overall network. Open vulnerabilities are compiled and analyzed on a quarterly basis and a subset of NIST 800-53 controls are tested annually. Additionally, a SAS70 audit which includes a review of system security practices is conducted on an annual basis and reported to NARA.

10

Page 11: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

10. Identify a point of contact for any additional questions from users regarding the security of the system. Linda Ferro NHV - St Louis Email: [email protected] Phone: 314.801.0957

Section 7: Is this a system of records covered by the Privacy Act?

1. Under which Privacy Act systems of records notice does the system operate? Provide number and name. Data in the NPRC Registry Files provide information conceming records that remain in the legal custody of the originating agency. The Privacy Act system of records notices referenced below apply to the collection and maintenance of OPF's and OMPF's by the originating DOD agencies. Those agencies published the SORN's referenced below.

Routine Uses of the Military Personnel Records Jacket Files A0640-10a

TAPC and Official Military Personnel File, A0640-10b TAPC

Health Care and Medical Treatment Record System A0040-66b DASG

Conectional Reporting System (CRS), AOl90-47 DAMO

Courts Martial Files A0027-10b DAJA

Air Force Military Personnel Records System FO 36 AF PC C

Air Force Dental Health Records FO 44 AF SG C

Air Force Medical Records System FO 44 AF SG E

Air Force Conection and Rehabilitation Records; FO 31 AF SP A

Air Force Family Advocacy Program Record System FO 44 AF SGQ

Navy Personnel Records System NO 1070-3

Navy and Marine Corps Health Care Treatment Record System No 6150-2

Medical Department Professional/Technical Persormel Development; NO 6150-1

U.S. Navy/Marine Corps Individual Correctional Records; NO 1640-1

11

Page 12: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

Summary courts-martial and non-bad conduct discharge courts-martial ~ Navy and Marine Corps; NO 5814-1

Family Advocacy Program System NO 1752-1

Marine Corps Military Personnel Records System (OQR/SRB), MMN 00006

Official Officer Service Records. DOT/CG 626

Enlisted Personnel Record System. DOT/CG 629

Military Health Record System. DOT/CG 572

2. If the system is being modified, will the Privacy Act system of records notice require amendment or revision? Explain.

The system is not being modified. However, any revision of the applicable system of records notice(s) would be the responsibility of the originating agency.

Conclusions and Analysis

1. Did any pertinent issues arise during the drafting of this Assessment? No.

2. If so, what changes were made to the system/application to compensate? N/A

See Attached Approval Page

12

Page 13: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

Privacv Review Approval Document

(Signature) • 4 ^ u ̂ (Date) RONALD L. HINBMAN, NRP Director, Natioy^l Personnel Records Center (NPRC) and NPRC Registry Files System Owner Room 2075 Phone: 314.801.0574

2^ (Signature) ?//(fAf (Date) M. STEl

General Counsel and Senior Agency Official for Privacy (NGC) Room 3100, All Phone: 301.837.3026

(Signature) (Date) 4ARTHAMORP1 MAR

Assistant Archivist for Information Services and Chief Information Officer (NH) Room 4400, All Phone: 301.837.1992

Page 14: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

Agency Number Agency Site

1 Air Force Personnel Center, DPPPRA (Awards and Decorations) Randolph

3 Anny - HRC, ATTN PAV-V (Veterans Support Branch) St Louis

11 Commander, CGPC-adm-3 Arlington

101 Navy Personnel Command, Retired Records Section (PERS-312D2) St LOUIS

501 Air Force, Secretary of, ATTN MRBR (Board for Correction of Military Records) Randolph

506 Marine Corps Liaison Office St Louis

507 Air Force Liaison and Recruiting LNO St LOUIS

508 OPM - FIS (Federal Investigative Services) St LOUIS

509 Amiy Review Boards Agency (ARBA) St LOUIS

510 Air Force, ANG (Air National Guard) St LOUIS

511 Army - HRC, ATTN. NG (National Guard Liaison Office) St. LOUIS

512 Federal Aviation Administration (FAA) St LOUIS

514 Navy Cnminal Investigative Servia; (NCIS) St LOUIS, MO

515 Secret Service, U S (Room 4597D) St LOUIS, NPRC

516 Anny - USAREC LIAISON TEAM St LOUIS

517 Central Intelligence Agency (CIA) St LOUIS, MO

518 OPM - USIS (US Investigations Services) St LOUIS, MO

520 Federal Bureau of Investigation (FBI) St LOUIS

521 Anmy - HRC, ATTN- CIS (Records Management Directorate) St LOUIS

522 Air Force Reserve Recruiting, AFRC/RSO St LOUIS

523 Anny - HRC, ATTN RSW (Regional Support Western) St LOUIS

524 Army - HRC, ATTN: PA (Personnel Actions and Services Directorate) St LOUIS

525 Arniy - HRC, ATTN' RSE-AAA (Eastern Region, 77th Actions) St LOUIS

526 Army - HRC, ATTN- RSE-BA (Eastern Region, 81st Actions) St LOUIS

527 Army - HRC, ATTN: RSE-CA (Eastern Region, 99th Actions) St. LOUIS

528 Amiy - HRC, ATTN: RSE-DA (Eastern Region, OCONUS Actions St LOUIS

529 Anny - HRC, ATTN CO (CommuniMtions Hub Office) St LOUIS

530 Army - HRC, ATTN PAO (Public Affairs Office) St LOUIS

531 Army - HRC, ATTN CS-S (Director of Staff) St LOUIS

532 Amiy - HRC, ATTN PAV-A (AORS/DEERS Branch) St LOUIS

533 Army - HRC, ATTN- PSS (Infomiation Support Activity) St LOUIS

534 Amiy - HRC, ATTN: RSA (AMEDD Region) St Louis

535 Amiy - HRC, ATTN: PLF (Plans Directorate - Security Office) St Louis

536 Amiy - HRC, ATTN PLF (U S. Army Field Support Center) St Louis

537 Anny - HRC, ATTN MSL (Office of Promotions, Reserve Components) St LOUIS

538 Anny - HRC, ATTN. IG-S (Inspector General) St Louis

539 Navy Personnel Command, ATTN PERS-312 Millington, TN

540 Air Force Services Agency, ATTN HQ AFSVA/SVOM (Mortuary Affairs Program) San Antonio, TX Randolph AFB,

541 Air Force Personnel Center, ATTN- [)PFCM (Missing Persons Branch) TX Randolph AFB,

542 Air Force Personnel Center, ATTN DPSOMP (Master Personnel Record & Procedures) TX Randolph AFB,

543 Air Force Personnel Center, ATTN PBX (Special Selection Boards) TX Randolph AFB,

544 Air Force Personnel Center, ATTN. DPPD (AF Disability) TX

14

Page 15: Privacy Impact Assessment Name of Project: NPRC Registry ... · The system also contains information on certain govemment VIPs such ... includes employer name and ... ACRS Time Sharing

Agency Number

545

546

547

548

549

550

551

552

553

554

555

556

557

558

559

560

561

562

563

564

565

566

567

568

569

570

571

572

573

574

575

576

577

578

579

580

Agency

Air Force Personnel Center, ATTN- DSI (IG Investigations & Inquiries)

Air Force Personnel Center, ATTN: DPPAOR (Service Dates)

Air Force Personnel Center, ATTN- DPPPWM (AFPC Enlisted Promotions)

Air Force Personnel Center, ATTN. DPDXIDL (World Wide Locator)

Air Force Personnel Center, ATTN. DPPRY (Systems & 214 Corrections)

Air Force Personnel Center, ATTN- DPSOOR (DEERS/RAPIDS)

Air Force Personnel Center, ATTN. DPSOM (Master Personnel Records Branch)

Department of Veterans Affairs, AITN: VALNO (VA Liaison Office)

Air Force Reserve Personnel Center, ATTN IGQ (High Level Inquines)

Air Force Reserve Personnel Center, ATTN: DPQ (Contract Support)

Air Force (HQ USAF/REPP) Personnel, Plans and Training Div for the Ofc of AF Reserve

Air Force Reserve Personnel Center, ATTN. DPBR (Officer Selection Records)

Air Force (AFLOA/JACT) - AF Legal Operations Agency (Claims & Torts Litigation Div)

Air Force (AFLOA/JACL) - AF Legal Operations Agency (General Litigation Division)

DOD - United States Transportatior Command (USTRANSCOM), ATTN. USTC-J1

Amny - HRC, ATTN AHRC-PDO-PA (Awards Branch)

Air Force Reserve Personnel Center, ATTN: DPPS (Separations Division)

Air Reserve Personnel Center, ATTN. DPPRC (Retirement Eligibility)

Coast Guard - BCMR (Board for Correction of Military Records)

OPM - Center for Federal Investigative Service

Navy - Board of Corrections of Naval Records

Navy - Naval Council of Personnel Boards

Coast Guard Personnel Service Center/USCG PSC (SES-4)

Army - Legal Services Agency, Litigation Division

Defense POW/Missing Personnel Office

Army - AHRC, ATTN. PER (Repatnation and Family Affairs Division)

Air Force - OSI (Office of Special Investigations)

Air Force - HQ AFSC/SEWN (AF Safety Center)

Department of Veterans Affairs - Records Management Center (VA-RMC)

Air Force Reserve Personnel Center, ATTN DPQR (Records Control)

Air Force Reserve Personnel Center, ATTN- DPPE (Entitlements Division)

Army - HRC, ATTN: POZ-CRSC (Combat Related Special Compensation)

Navy Chief Of Naval Operations, CN0(DNS-5)

Coast Guard, Office of Military Personnel, CG-1221

Air Force Personnel Center, ATTN: DPPDC (Combat - Related Special Compensation)

Army - AHRC, ATTN OPD-R ( Reserve Appointments Branch)

Site Randolph AFB, TX Randolph AFB, TX Randolph AFB, TX Randolph AFB, TX Randolph AFB, TX Randolph AFB, TX Randolph AFB, TX

St. Louis

Denver, CO

Denver, CO

Washington, DC

Denver, CO

Arlington, VA

Arlington, VA

Scott AFB, IL

Alexandna, VA

Denver, CO

Denver, CO

Washington, DC

Fort Meade, MD

Washington, DC

Washington, DC

Topeka, KS

Arlington, VA

Arlington, VA

Alexandria, VA

Scott AFB, IL Kirtland AFB, NM

St. Louis, MO

Denver, CO

Denver, CO

Alexandna, VA

Washington, DC

Washington, DC Randolph AFB, TX

St. Louis, MO

15


Recommended